Subject: [mobile-ip] issues in mipv6-ipsec: prefix discovery

From: Jari Arkko <[email-masked]>
Date: Fri, 27 Sep 2002 16:07:02 +0300

Section 5.3, 7.2.3, and 7.3.3 in draft-ietf-mobileip-mipv6-ha-ipsec-00.txt
indicate that the prefix discovery messages are sent using the mobile
node's home address. This does not match the text in the base MIPv6
document in Section 6.7 which says to use care-of addresses.

The format can easily be changed in 5.3, but does this imply
any modifications to the SPD entries? It seems so. Or should
the MIPv6 draft be changed? Note that if we require IPsec
security to a care-of address, then this implies IKE as
otherwise the SA doesn't exist to the given direction.

A few possible approaches to fix this:

- Adopt the use of home addresses for prefix discovery.
   See also my second issue e-mail about DHAAD
   protection.

- Continue to use care-of addresses, make prefix
   discovery a MAY and whenever prefix discovery is
   implemnted make IKE a MUST.

- Something else, what?

Jari

---

From: Vladislav Yasevich <[email-masked]>
Date: Fri, 27 Sep 2002 09:37:05 -0400

Jari

>   See also my second issue e-mail about DHAAD

Agree.

As an aside, it would be interesting to recall why
the care-or address was originally specified for prefix discovery.
The only reason I remember is to allow MN bootstraping without
the knowledge of at least one home address.

-vlad
-- 
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Vladislav Yasevich		Tru64 UNIX - IPv6 Project Lead
Hewlett Packard 		Tel: (603) 884-1079
Nashua, NH 03062		ZKO3-3/T07